Loading vulnerability…
Privilege Escalation via Pipeline Schedules in GitLab CE/EE
CVE-2023-2022 is a privilege escalation vulnerability in GitLab CE/EE affecting all versions before 16.0.8, 16.1 before 16.1.3, and 16.2 before 16.2.2. The flaw allows developers to create pipeline schedules on protected branches even if they lack merge access. This bypasses intended access controls on protected branches, potentially allowing unauthorized code execution or changes via scheduled pipelines.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Attackers with developer permissions, but without merge access to protected branches, can schedule pipelines on those branches. This could lead to unauthorized code execution, deployment, or other actions that should be restricted to users with higher privileges, undermining branch protection mechanisms.
If you can’t patch tonight, do this now.
Restrict developer permissions where possible, monitor pipeline schedules on protected branches for unauthorized activity, and apply the latest security updates promptly.
Patch, then assume compromise.
Upgrade GitLab CE/EE to version 16.0.8, 16.1.3, 16.2.2 or later, where the vulnerability has been patched and proper access controls are enforced for pipeline scheduling on protected branches.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.